shiro 默认是把 session id 存放在 cookie 中的，如果前后台同源会在请求的时候自动带上 cookie，这样子后台就可以从 cookie 中拿到 session id，但是如果跨域就无法获取到 cookie，所以 session id 每次都无法获取到，每次都会重新生成新的 session id。
    解决办法：自定义获取 session id 的方法，从请求头中获取，登陆接口返回 session id，前后端约定将 session id 放在请求头的 Authorization 字段中。
    OnlineWebSessionManager 自定义 session 管理器：

    1. public class OnlineWebSessionManager extends DefaultWebSessionManager {
    3.     private static final Logger log = LoggerFactory.getLogger(OnlineWebSessionManager.class);
    5.     /**
    6.      * 自定义获取 session Id 类
    7.      * @param request
    8.      * @param response
    9.      * @return
    10.      */
    11.     @Override
    12.     public Serializable getSessionId(ServletRequest request, ServletResponse response) {
    13.         return getReferencedSessionId(request, response);
    14.     }
    16.     /**
    17.      * 获取sessionId从请求中
    18.      *
    19.      * @param request
    20.      * @param response
    21.      * @return
    22.      */
    23.     private Serializable getReferencedSessionId(ServletRequest request, ServletResponse response) {
    24.         String id = getSessionIdCookieValue(request, response);
    25.         if (id != null) {
    26.             request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, "cookie");
    27.         } else {
    28.             id = getUriPathSegmentParamValue(request);
    29.             if (id == null) {
    30.                 // 获取请求头中的session
    31.                 id = WebUtils.toHttp(request).getHeader("Authorization");
    32.                 if (id == null) {
    33.                     String name = getSessionIdName();
    34.                     id = request.getParameter(name);
    35.                     if (id == null) {
    36.                         id = request.getParameter(name.toLowerCase());
    37.                     }
    38.                 }
    39.             }
    40.             if (id != null) {
    41.                 request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, "url");
    42.             }
    43.         }
    45.         if (id != null) {
    46.             request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
    47.             request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
    48.         }
    49.         return id;
    50.     }
    52.     // copy from super class
    53.     private String getSessionIdCookieValue(ServletRequest request, ServletResponse response) {
    54.         if (!isSessionIdCookieEnabled()) {
    55.             log.debug("Session ID cookie is disabled - session id will not be acquired from a request cookie.");
    56.             return null;
    57.         } else if (!(request instanceof HttpServletRequest)) {
    58.             log.debug("Current request is not an HttpServletRequest - cannot get session ID cookie.  Returning null.");
    59.             return null;
    60.         } else {
    61.             HttpServletRequest httpRequest = (HttpServletRequest) request;
    62.             return getSessionIdCookie().readValue(httpRequest, WebUtils.toHttp(response));
    63.         }
    64.     }
    66.     // copy from super class
    67.     private String getUriPathSegmentParamValue(ServletRequest servletRequest) {
    68.         if (!(servletRequest instanceof HttpServletRequest)) {
    69.             return null;
    70.         } else {
    71.             HttpServletRequest request = (HttpServletRequest) servletRequest;
    72.             String uri = request.getRequestURI();
    73.             if (uri == null) {
    74.                 return null;
    75.             } else {
    76.                 int queryStartIndex = uri.indexOf(63);
    77.                 if (queryStartIndex >= 0) {
    78.                     uri = uri.substring(0, queryStartIndex);
    79.                 }
    81.                 int index = uri.indexOf(59);
    82.                 if (index < 0) {
    83.                     return null;
    84.                 } else {
    85.                     String TOKEN = "JSESSIONID" + "=";
    86.                     uri = uri.substring(index + 1);
    87.                     index = uri.lastIndexOf(TOKEN);
    88.                     if (index < 0) {
    89.                         return null;
    90.                     } else {
    91.                         uri = uri.substring(index + TOKEN.length());
    92.                         index = uri.indexOf(59);
    93.                         if (index >= 0) {
    94.                             uri = uri.substring(0, index);
    95.                         }
    96.                         return uri;
    97.                     }
    98.                 }
    99.             }
    100.         }
    101.     }
    103.     // copy from super class
    104.     private String getSessionIdName() {
    105.         String name = getSessionIdCookie() != null ? getSessionIdCookie().getName() : null;
    106.         if (name == null) {
    107.             name = "JSESSIONID";
    108.         }
    109.         return name;
    110.     }
    111. }